@rehearsal-db/core 0.1.0-rc.7 → 0.1.0-rc.9

package/CHANGELOG.md

@@ -3,6 +3,40 @@
 All notable Rehearsal package changes will be documented here. The format follows Keep
 a Changelog, and versions will follow Semantic Versioning after the package exists.
 
+## [Unreleased]
+
+## [0.1.0-rc.9] - 2026-10-17
+
+### Fixed
+
+- Wrong or stale source-access approval and review-required privacy drafts report
+  actionable configuration refusals instead of internal failures. Source access,
+  privacy review and baseline-preservation requirements are unchanged.
+
+## [0.1.0-rc.8] - 2026-10-17
+
+### Added
+
+- Optional interactive update reminders, with explicit network consent, daily
+  opening-session checks, defer/skip/disable choices and exact-version guidance.
+  Machine commands remain network-free, custom installations stay manual-only,
+  and no update installs automatically.
+
+### Fixed
+
+- Invalid positive-integer configuration settings and rejected configuration proposals
+  report configuration failures rather than baseline or internal failures. Review
+  remains non-writing, and unexpected faults retain their original failure category.
+
+### Documentation
+
+- Separate released VSIX installation, dashboard access, and updates from contributor
+  setup and separately approved commercial launch requirements.
+- Clarify that configured database and Storage data remain persistent and that no
+  separate temporary Docker-helper ownership or cleanup capability exists today.
+- Explain profile startup and resource measurements without equating cached-image
+  container checks with a cold VM or whole-machine memory benchmark.
+
 ## [0.1.0-rc.7] - 2026-10-15
 
 ### Fixed

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@rehearsal-db/core",
-    "version": "0.1.0-rc.7",
+    "version": "0.1.0-rc.9",
     "private": false,
     "description": "Catch PostgreSQL and Supabase migrations that pass on empty databases but fail on real data—before deploy.",
     "repository": {

package/dist/src/baseline/privacy_policy.mjs

@@ -1,6 +1,7 @@
 /**
  * Validate and normalize the complete reviewed privacy policy version 2.
  */
+import { RehearsalError } from "../shared/diagnostics.mjs";
 import { validatePrivacyDependencyGraph } from "./privacy_dependency_graph.mjs";
 import { validatePrivacyRecipe } from "./privacy_recipe_validation.mjs";
 import { ACTIONS, BINDING_NAME, DEFAULT_PATH_MAXIMUM_BYTES, DEFAULT_PATH_MAXIMUM_SEGMENTS, ENVIRONMENT_KEY, HEX_64, assertKnownKeys as knownKeys, isPrivacyObject as isObject, validateIdentifier as identifier, validateNonEmpty as nonEmpty, validatePositiveInteger as positiveInteger, } from "./privacy_validation_shared.mjs";
@@ -19,7 +20,18 @@ export const validateExecutablePrivacyPolicy = (policy) => {
         throw new Error("Executable privacy policies must use policyVersion 2.");
     }
     if (policy.draft === true) {
-        throw new Error("The privacy policy is still a REVIEW REQUIRED draft.");
+        throw new RehearsalError({
+            category: "configuration_invalid",
+            code: "CONFIGURATION_INVALID",
+            message: "The privacy policy is still a REVIEW REQUIRED draft.",
+            expected: "A complete, explicitly reviewed and approved privacy policy.",
+            actual: "REVIEW REQUIRED draft.",
+            refused: "This draft policy was not accepted for source export or baseline activation.",
+            suggestions: [
+                "Review every exported table, column, recipe and source-data boundary, and obtain explicit privacy approval before completing this draft.",
+                "Do not remove the draft marker merely to bypass review. After approval, rerun rehearsal baseline refresh.",
+            ],
+        });
     }
     if (typeof policy.migrationCutoff !== "string" ||
         !/^\d{14}$/u.test(policy.migrationCutoff)) {

package/dist/src/cli/guided.mjs

@@ -4,6 +4,7 @@
 import { access, readFile } from "node:fs/promises";
 import { join, relative } from "node:path";
 import * as prompts from "@clack/prompts";
+import { createGuidedUpdates } from "./guided_updates.mjs";
 import { findRehearsalConfigPath, inspectDetectedProject, loadRehearsalConfig, } from "../project/configuration.mjs";
 import { validateRuntimeSanitizationPolicy } from "../baseline/sanitization_policy.mjs";
 import { inspectRehearsalNodeRuntime, planRehearsalSetup, summarizeRehearsalSetup, } from "../project/setup.mjs";
@@ -280,7 +281,7 @@ const reviewPolicyInteractively = async ({ state, flags, }) => {
     }
     return true;
 };
-const guidedOptions = (state, hasLastDetails) => {
+const guidedOptions = (state, hasLastDetails, showUpdates) => {
     const options = [];
     if (!state.node.supported) {
         options.push({
@@ -370,7 +371,9 @@ const guidedOptions = (state, hasLastDetails) => {
         label: "Get help",
         hint: "Create a safe, copy-ready support report",
         command: "support",
-    }, { label: "Show all commands", command: "help" }, { label: "Exit", command: "exit" });
+    }, { label: "Show all commands", command: "help" }, ...(showUpdates
+        ? [{ label: "Check for updates", command: "check-updates" }]
+        : []), { label: "Exit", command: "exit" });
     return options;
 };
 const showGuidedStatus = ({ state, options, flags, }) => {
@@ -575,153 +578,165 @@ const guideBaseline = async ({ state, selected, flags, planOptions, projectRoot,
         return "home";
     }
 };
-export const createGuidedHome = ({ projectRoot, topologyCandidateSummary, buildRefreshWorkflowPlan, planRuntimeStackCleanup, getLastGuidedDetails, session, }) => async ({ flags, planOptions, }) => {
-    const state = await inspectGuidedProject({
-        projectRoot,
-        planOptions,
-        topologyCandidateSummary,
-    });
-    const lastDetails = getLastGuidedDetails();
-    const options = guidedOptions(state, Boolean(lastDetails));
-    showGuidedStatus({ state, options, flags });
-    const selected = await promptForChoice({
-        message: "What would you like to do?",
-        options,
-        flags,
-        optionsAlreadyShown: !useStyledPrompts(flags),
-    });
-    if (!selected || selected.command === "exit")
-        return null;
-    if (selected.command === "node-help") {
-        console.log([
-            "",
-            terminalStyle(flags, "1", "SUPPORTED NODE.JS REQUIRED"),
-            `This shell is using Node.js ${state.node.version}. Rehearsal has not changed your project.`,
-            `Supported releases: ${REHEARSAL_NODE_LABEL}.`,
-            "",
-            "Recommended with nvm:",
-            "  nvm install --lts",
-            "  nvm use --lts",
-            "",
-            "Then reinstall Rehearsal in your scratch project and run npx rehearsal again.",
-        ].join("\n"));
-        return "home";
-    }
-    if (selected.command === "policy-review") {
-        try {
-            await reviewPolicyInteractively({ state, flags });
+export const createGuidedHome = ({ projectRoot, topologyCandidateSummary, buildRefreshWorkflowPlan, planRuntimeStackCleanup, getLastGuidedDetails, session, }) => {
+    const updates = createGuidedUpdates({ projectRoot });
+    return async ({ flags, planOptions, }) => {
+        if (await updates(flags))
+            return null;
+        const state = await inspectGuidedProject({
+            projectRoot,
+            planOptions,
+            topologyCandidateSummary,
+        });
+        const lastDetails = getLastGuidedDetails();
+        const options = guidedOptions(state, Boolean(lastDetails), !flags.json &&
+            Boolean(process.stdin.isTTY && process.stdout.isTTY) &&
+            !process.env.CI &&
+            !process.env.CODEX_CI &&
+            process.env.REHEARSAL_UPDATE_CHECK !== "off");
+        showGuidedStatus({ state, options, flags });
+        const selected = await promptForChoice({
+            message: "What would you like to do?",
+            options,
+            flags,
+            optionsAlreadyShown: !useStyledPrompts(flags),
+        });
+        if (!selected || selected.command === "exit")
+            return null;
+        if (selected.command === "check-updates") {
+            return (await updates(flags, true)) ? null : "home";
+        }
+        if (selected.command === "node-help") {
+            console.log([
+                "",
+                terminalStyle(flags, "1", "SUPPORTED NODE.JS REQUIRED"),
+                `This shell is using Node.js ${state.node.version}. Rehearsal has not changed your project.`,
+                `Supported releases: ${REHEARSAL_NODE_LABEL}.`,
+                "",
+                "Recommended with nvm:",
+                "  nvm install --lts",
+                "  nvm use --lts",
+                "",
+                "Then reinstall Rehearsal in your scratch project and run npx rehearsal again.",
+            ].join("\n"));
+            return "home";
         }
-        catch (error) {
-            if (errorMessage(error) !== "Policy review was cancelled.") {
-                throw error;
+        if (selected.command === "policy-review") {
+            try {
+                await reviewPolicyInteractively({ state, flags });
             }
+            catch (error) {
+                if (errorMessage(error) !== "Policy review was cancelled.") {
+                    throw error;
+                }
+                if (useStyledPrompts(flags)) {
+                    prompts.cancel("Policy review cancelled; the draft was not changed.");
+                }
+                else {
+                    console.log("Policy review cancelled; the draft was not changed.");
+                }
+            }
+            return "home";
+        }
+        if (selected.command === "last-details") {
             if (useStyledPrompts(flags)) {
-                prompts.cancel("Policy review cancelled; the draft was not changed.");
+                prompts.note(lastDetails, "Technical details");
             }
             else {
-                console.log("Policy review cancelled; the draft was not changed.");
+                console.log(`\nTECHNICAL DETAILS\n${lastDetails}`);
             }
+            return "home";
         }
-        return "home";
-    }
-    if (selected.command === "last-details") {
-        if (useStyledPrompts(flags)) {
-            prompts.note(lastDetails, "Technical details");
+        if (selected.command === "refresh-guide") {
+            const { plan } = await buildRefreshWorkflowPlan(planOptions);
+            console.log(`\n${renderRefreshWorkflow({ mode: "preview", plan })}\n`);
+            const accepted = await promptForConfirmation("Create this replacement, discard current runtime edits, and remove exactly the listed old copies after success?", flags);
+            if (!accepted)
+                return "home";
+            flags.refreshConfirmation = plan.digest;
+            return "refresh";
         }
-        else {
-            console.log(`\nTECHNICAL DETAILS\n${lastDetails}`);
+        if (selected.command === "manage-runtime") {
+            const runtimeAction = await promptForChoice({
+                message: "Manage the disposable local runtime",
+                flags,
+                options: [
+                    { label: "Show status", command: "status" },
+                    { label: "Verify runtime", command: "verify" },
+                    { label: "Reset to the immutable baseline", command: "reset" },
+                    { label: "Stop runtime", command: "stop" },
+                    { label: "Discard runtime", command: "discard" },
+                    { label: "Back", command: "exit" },
+                ],
+            });
+            if (!runtimeAction || runtimeAction.command === "exit")
+                return "home";
+            if (["reset", "discard"].includes(runtimeAction.command)) {
+                const accepted = await promptForConfirmation(runtimeAction.command === "reset"
+                    ? "Reset the disposable runtime and remove its current changes?"
+                    : "Discard the disposable runtime? The immutable baseline will remain.", flags);
+                if (!accepted)
+                    return "home";
+            }
+            return runtimeAction.command;
         }
-        return "home";
-    }
-    if (selected.command === "refresh-guide") {
-        const { plan } = await buildRefreshWorkflowPlan(planOptions);
-        console.log(`\n${renderRefreshWorkflow({ mode: "preview", plan })}\n`);
-        const accepted = await promptForConfirmation("Create this replacement, discard current runtime edits, and remove exactly the listed old copies after success?", flags);
-        if (!accepted)
-            return "home";
-        flags.refreshConfirmation = plan.digest;
-        return "refresh";
-    }
-    if (selected.command === "manage-runtime") {
-        const runtimeAction = await promptForChoice({
-            message: "Manage the disposable local runtime",
+        if (selected.command === "cleanup-guide") {
+            return guideCleanup({
+                flags,
+                planOptions,
+                planRuntimeStackCleanup,
+                session,
+            });
+        }
+        if (["baseline-guide", "baseline-prepare"].includes(selected.command)) {
+            return guideBaseline({
+                state,
+                selected,
+                flags,
+                planOptions,
+                projectRoot,
+                session,
+            });
+        }
+        if (selected.command !== "setup-write")
+            return selected.command;
+        const targetChoice = await promptForChoice({
+            message: "Which database should Rehearsal use?",
             flags,
-            options: [
-                { label: "Show status", command: "status" },
-                { label: "Verify runtime", command: "verify" },
-                { label: "Reset to the immutable baseline", command: "reset" },
-                { label: "Stop runtime", command: "stop" },
-                { label: "Discard runtime", command: "discard" },
-                { label: "Back", command: "exit" },
-            ],
+            options: state.target === "supabase"
+                ? [
+                    { label: "Supabase", command: "supabase" },
+                    { label: "PostgreSQL", command: "postgresql" },
+                ]
+                : [
+                    { label: "PostgreSQL", command: "postgresql" },
+                    { label: "Supabase", command: "supabase" },
+                ],
         });
-        if (!runtimeAction || runtimeAction.command === "exit")
+        if (!targetChoice)
             return "home";
-        if (["reset", "discard"].includes(runtimeAction.command)) {
-            const accepted = await promptForConfirmation(runtimeAction.command === "reset"
-                ? "Reset the disposable runtime and remove its current changes?"
-                : "Discard the disposable runtime? The immutable baseline will remain.", flags);
-            if (!accepted)
-                return "home";
+        if (targetChoice.command !== "supabase" &&
+            targetChoice.command !== "postgresql") {
+            throw new Error("Unsupported guided runtime target.");
         }
-        return runtimeAction.command;
-    }
-    if (selected.command === "cleanup-guide") {
-        return guideCleanup({
-            flags,
-            planOptions,
-            planRuntimeStackCleanup,
-            session,
-        });
-    }
-    if (["baseline-guide", "baseline-prepare"].includes(selected.command)) {
-        return guideBaseline({
-            state,
-            selected,
-            flags,
-            planOptions,
+        const target = targetChoice.command;
+        flags.target = target;
+        const setupPlan = await planRehearsalSetup({
             projectRoot,
-            session,
+            target,
         });
-    }
-    if (selected.command !== "setup-write")
-        return selected.command;
-    const targetChoice = await promptForChoice({
-        message: "Which database should Rehearsal use?",
-        flags,
-        options: state.target === "supabase"
-            ? [
-                { label: "Supabase", command: "supabase" },
-                { label: "PostgreSQL", command: "postgresql" },
-            ]
-            : [
-                { label: "PostgreSQL", command: "postgresql" },
-                { label: "Supabase", command: "supabase" },
-            ],
-    });
-    if (!targetChoice)
-        return "home";
-    if (targetChoice.command !== "supabase" &&
-        targetChoice.command !== "postgresql") {
-        throw new Error("Unsupported guided runtime target.");
-    }
-    const target = targetChoice.command;
-    flags.target = target;
-    const setupPlan = await planRehearsalSetup({
-        projectRoot,
-        target,
-    });
-    const preview = {
-        ...summarizeRehearsalSetup(setupPlan, { mode: "preview" }),
-        nextAction: "Review this plan. No files are written unless you approve below.",
+        const preview = {
+            ...summarizeRehearsalSetup(setupPlan, { mode: "preview" }),
+            nextAction: "Review this plan. No files are written unless you approve below.",
+        };
+        console.log(`\n${renderSetup(preview)}\n`);
+        const accepted = await promptForConfirmation("Create these project-local files?", flags);
+        if (!accepted) {
+            console.log("No changes made.");
+            return "home";
+        }
+        session.setupPlan = setupPlan;
+        flags.write = true;
+        return "setup";
     };
-    console.log(`\n${renderSetup(preview)}\n`);
-    const accepted = await promptForConfirmation("Create these project-local files?", flags);
-    if (!accepted) {
-        console.log("No changes made.");
-        return "home";
-    }
-    session.setupPlan = setupPlan;
-    flags.write = true;
-    return "setup";
 };

package/dist/src/cli/guided_updates.d.mts

@@ -0,0 +1,14 @@
+/** Consent and reminders belong to the interactive guide, never machine commands. */
+import type { TerminalFlags } from "./terminal.mjs";
+import { promptForChoice } from "./terminal.mjs";
+export declare function createGuidedUpdates({ projectRoot, installed, directory: configuredDirectory, fetchImplementation, now, environment, terminal, choose, write, }: {
+    projectRoot: string;
+    installed?: string;
+    directory?: string;
+    fetchImplementation?: typeof fetch;
+    now?: () => number;
+    environment?: NodeJS.ProcessEnv;
+    terminal?: () => boolean;
+    choose?: typeof promptForChoice;
+    write?: (text: string) => void;
+}): (flags: TerminalFlags, manual?: boolean) => Promise<boolean>;

package/dist/src/cli/guided_updates.mjs

@@ -0,0 +1,148 @@
+import { isAbsolute } from "node:path";
+import { promptForChoice } from "./terminal.mjs";
+import { REHEARSAL_VERSION } from "../shared/diagnostics.mjs";
+import { UPDATE_DAY, checkCoreUpdate, coreUpdateCommand, defaultUpdateDirectory, readUpdatePreference, saveUpdatePreference, } from "./update_advisory.mjs";
+export function createGuidedUpdates({ projectRoot, installed = REHEARSAL_VERSION, directory: configuredDirectory, fetchImplementation = fetch, now = Date.now, environment = process.env, terminal = () => Boolean(process.stdin.isTTY && process.stdout.isTTY), choose = promptForChoice, write = (text) => console.log(text), }) {
+    let opened = false;
+    const directory = configuredDirectory ??
+        environment.REHEARSAL_UPDATE_STATE_DIR ??
+        defaultUpdateDirectory();
+    const select = async (input) => {
+        try {
+            return await choose(input);
+        }
+        catch (error) {
+            // Node's plain readline prompt rejects on a terminal Ctrl+C. Treat only
+            // that observed cancellation as an exit; unexpected prompt faults remain errors.
+            if (error instanceof Error &&
+                error.name === "AbortError" &&
+                "code" in error &&
+                error.code === "ABORT_ERR" &&
+                error.message === "Aborted with Ctrl+C")
+                return undefined;
+            throw error;
+        }
+    };
+    return async (flags, manual = false) => {
+        if (flags.json || !terminal() || environment.CI || environment.CODEX_CI) {
+            return false;
+        }
+        if (environment.REHEARSAL_UPDATE_CHECK === "off") {
+            if (manual)
+                write("Update checks are disabled in this session. No network request was made.");
+            return false;
+        }
+        if (!manual && opened)
+            return false;
+        opened = true;
+        if (!isAbsolute(directory) ||
+            directory.length > 4096 ||
+            /[\x00-\x1f\x7f]/u.test(directory)) {
+            write("Update preference location is invalid. No update check was made; local work can continue.");
+            return false;
+        }
+        const time = now();
+        const preference = await readUpdatePreference(directory, time);
+        let expectedPreference = { ...preference };
+        let explicitConsent = false;
+        const persist = async () => {
+            const saved = await saveUpdatePreference(directory, preference, expectedPreference);
+            if (!saved)
+                write("Update preferences changed or could not be saved. Automatic checks stop here; use Check for updates for an explicit check.");
+            else
+                expectedPreference = { ...preference };
+            return saved;
+        };
+        if (!manual &&
+            (preference.permission === "disabled" ||
+                (preference.lastCheckAt !== null &&
+                    time - preference.lastCheckAt < UPDATE_DAY) ||
+                (preference.lastPromptAt !== null &&
+                    time - preference.lastPromptAt < UPDATE_DAY)))
+            return false;
+        if (manual || preference.permission !== "enabled") {
+            const consent = await select({
+                message: "Check npm for Rehearsal updates?",
+                flags,
+                options: [
+                    { label: "Not now", command: "later" },
+                    {
+                        label: "Check once",
+                        command: "once",
+                        hint: "Contacts registry.npmjs.org; no project data or credentials are sent",
+                    },
+                    {
+                        label: "Check and remind me daily",
+                        command: "enable",
+                        hint: "Only when opening this interactive guide",
+                    },
+                    { label: "Disable reminders", command: "disable" },
+                ],
+            });
+            preference.lastPromptAt = time;
+            if (!consent)
+                return true;
+            if (consent.command === "later") {
+                await persist();
+                return false;
+            }
+            if (consent.command === "disable") {
+                preference.permission = "disabled";
+                await persist();
+                return false;
+            }
+            if (!["once", "enable"].includes(consent.command ?? ""))
+                return false;
+            explicitConsent = true;
+            if (consent.command === "enable")
+                preference.permission = "enabled";
+        }
+        preference.lastCheckAt = time;
+        if (!(await persist()) && !explicitConsent)
+            return false;
+        write("Checking the published Rehearsal release…");
+        const release = await checkCoreUpdate({ installed, fetchImplementation });
+        if (release.state === "unavailable") {
+            write("Update information is unavailable. Continue normally; Check for updates can retry later.");
+            return false;
+        }
+        if (release.state !== "available") {
+            if (manual)
+                write(`Installed core ${installed}; published ${release.channel} release ${release.version}. ${release.state === "ahead" ? "Your installation is newer; it will not be downgraded." : "No newer release is available on this channel."}`);
+            return false;
+        }
+        if (!manual && preference.skippedVersion === release.version)
+            return false;
+        const command = await coreUpdateCommand(projectRoot, installed, release.version);
+        if (!command) {
+            write(`Published ${release.channel} release: ${release.version}. This update requires manual compatibility or installation-origin review; preserve reviewed artifacts and follow your project's update instructions.`);
+            return false;
+        }
+        const decision = await select({
+            message: `Core update available: ${installed} → ${release.version} (${release.channel})`,
+            flags,
+            options: [
+                { label: "Not now", command: "later" },
+                {
+                    label: "Show update command and exit",
+                    command: "update",
+                    hint: "Review compatibility; nothing installs automatically",
+                },
+                { label: "Skip this release", command: "skip" },
+                { label: "Disable reminders", command: "disable" },
+            ],
+        });
+        if (!decision)
+            return true;
+        preference.lastPromptAt = time;
+        if (decision?.command === "skip")
+            preference.skippedVersion = release.version;
+        if (decision?.command === "disable")
+            preference.permission = "disabled";
+        await persist();
+        if (decision?.command !== "update")
+            return false;
+        write(`\nCore ${installed} → ${release.version} (${release.channel})\nReview release compatibility: https://github.com/Ddupasquier/rehearsal-db/releases/tag/v${release.version}\nAfter this guide exits, run:\n  ${command}\nThis pins the reviewed version and changes the project manifest, lockfile and dependencies. Rehearsal has not installed anything. Review the dependency diff afterward.\n`);
+        return true;
+    };
+}

package/dist/src/cli/update_advisory.d.mts

@@ -0,0 +1,29 @@
+export declare const UPDATE_DAY = 86400000;
+type Channel = "stable" | "preview";
+export interface UpdatePreference {
+    schemaVersion: 1;
+    permission: "ask" | "enabled" | "disabled";
+    lastCheckAt: number | null;
+    lastPromptAt: number | null;
+    skippedVersion: string | null;
+}
+export declare const emptyUpdatePreference: () => UpdatePreference;
+export declare function compareUpdateVersions(left: string, right: string): number | null;
+export type CoreUpdate = {
+    state: "available" | "current" | "ahead";
+    version: string;
+    channel: Channel;
+} | {
+    state: "unavailable";
+    channel: Channel;
+};
+export declare function checkCoreUpdate({ installed, fetchImplementation, timeoutMs, }: {
+    installed: string;
+    fetchImplementation?: typeof fetch;
+    timeoutMs?: number;
+}): Promise<CoreUpdate>;
+export declare const defaultUpdateDirectory: () => string;
+export declare function readUpdatePreference(directory: string, now: number): Promise<UpdatePreference>;
+export declare function saveUpdatePreference(directory: string, value: UpdatePreference, expected?: UpdatePreference): Promise<boolean>;
+export declare function coreUpdateCommand(project: string, installed: string, available: string): Promise<string | null>;
+export {};